Sky Schedule Privacy Policy

1. Two Roles: Read This First

Sky Schedule handles personal information in two different roles.

1.1 For flight schools: we are the school’s service provider (Part B). Flight schools, flying clubs, FBOs, and other organizations (each a “School”) use the Services to run their operations. The information a School and its users put into the School’s workspace (for example, student, instructor, and staff profiles, documents, schedules, flight and training records, and invoices) is “School Data.”

• The School controls School Data. It decides what to collect, why, who in its organization can see it, and how long to keep it.
• Sky Schedule processes School Data only on the School’s behalf and on its instructions, as a “processor” or “service provider.”
• The School’s own privacy practices govern School Data. If you are a student, instructor, or staff member, contact your School first with questions or requests about your information. We will help the School respond.

1.2 For our own business: we are responsible (Part A). Sky Schedule decides how to use a smaller set of information for its own purposes, such as running user accounts, communicating with School customers, billing Schools for their subscriptions, securing the Services, handling inquiries from our website, and understanding how the Services are used.

1.3 How this Policy relates to our agreements. Our Terms of Service and, for Schools, the Sky Schedule Customer Agreement also apply. For School Data, the Customer Agreement controls if it conflicts with this Policy.

Part A: Information Sky Schedule Handles for Its Own Purposes

2. Information We Collect

2.1 Account and login information. Your name, email address, phone number (if you provide one), password (stored by our authentication provider in hashed form), the School or Schools you belong to, your role, and your account settings and notification preferences. If you sign in with Google, we receive your name, email address, and Google account identifier.

2.2 School customer and billing information. For Schools that subscribe to the Services: the School’s name and business details, billing contacts, subscription plan and add-ons, payment and invoice history for subscription fees, and records of Platform Fees. Stripe processes payment card and bank details. We do not store full card numbers, card security codes, or full bank account numbers.

2.3 Agreement acceptance records. When you accept our Terms of Service, Customer Agreement, or this Policy, we record who accepted, which version, the date and time, your IP address, and your browser or device information.

2.4 Usage, device, and security information. When you use the Services, we and our hosting providers automatically collect:

• sign-ins, sessions, and the pages, features, and actions you use;
• IP address and an approximate, city-level location derived from your IP address;
• browser, device, and operating system information;
• error, crash, and diagnostic information; and
• activity and audit logs.

2.5 Mobile app information. If you use our iPhone app and turn on notifications, we receive a device token from Apple so we can send push notifications. If you use features that take photos (such as checkout photos) or record your voice, the app asks for camera, photo, or microphone permission first.

2.6 Communications. Messages you send us, support requests, feedback, survey responses, and records of emails we send you, including whether they were delivered or opened.

2.7 Website and sales inquiries. If you request a demo, contact us, or chat with the assistant on our website, we collect what you provide, such as your name, email address, phone number, School name, and your messages. We keep this information in our own customer relationship records.

2.8 Information from others. Stripe gives us information about payment status and connected accounts. Integration providers you or your School connect (such as Google, Microsoft, or Intuit) share the information you authorize.

3. How We Use It

We use the information in Part A to:

1. create and manage accounts and authenticate users;
2. provide, maintain, troubleshoot, and support the Services;
3. bill Schools for subscriptions and collect Platform Fees;
4. send service messages, such as security alerts, account notices, receipts, policy updates, and product announcements;
5. respond to inquiries and send Schools and prospective Schools information about Sky Schedule. You can unsubscribe from marketing emails at any time;
6. monitor, secure, and protect the Services, detect and prevent fraud and abuse, and enforce our agreements (see Section 4);
7. analyze usage to improve the Services and build new features, using de-identified or aggregated data where practical;
8. keep records of agreement acceptance and comply with legal, tax, and accounting obligations; and
9. establish, exercise, or defend legal claims.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4. Monitoring

To keep the Services secure and reliable, to support Schools, and to enforce our agreements, Sky Schedule monitors and logs access to and use of the Services. This includes sign-ins and active sessions (with approximate, IP-based location), actions taken in the Services, API and automated access, email and message delivery events, and payment activity. We use these records to detect and stop conduct our Terms of Service prohibit, such as reverse engineering, scraping, and access by or for competitors. Authorized Sky Schedule personnel may access a School’s workspace, including with administrator-level access, to provide support, investigate problems or suspected violations, keep the Services secure, and operate the Services. We may keep these records and use them as evidence in a dispute.

5. Cookies and Similar Technologies

We use cookies, browser local storage, and similar technologies to keep you signed in, remember your preferences, and keep the Services secure. These are necessary for the Services to work. We also use Vercel Web Analytics to measure page views and performance in the app in aggregate. We do not use advertising cookies or third-party advertising trackers. Because we don’t sell or share personal information for targeted advertising, there is nothing to opt out of through a Global Privacy Control signal. We honor GPC signals as a request to opt out of any future sale or sharing anyway. Our Services do not respond differently to “Do Not Track” browser signals.

Part B: School Data We Process on Behalf of Schools

6. What School Data Can Include

Each School decides what it collects. Sky Schedule doesn’t require any School to collect any particular document or category of information. Depending on the features a School uses and what it chooses to enter, School Data can include:

• Profiles and contact details of students, renters, members, instructors, and staff: names, email addresses, phone numbers, mailing addresses, dates of birth, and parent or guardian contact information.
• Identity and eligibility documents: copies of government-issued IDs and passports, document type and expiration date, and verification status (for example, to help a School meet TSA flight-training security requirements).
• Pilot and medical certificate information: certificate and FAA medical certificate details, such as expiration dates, and uploaded copies.
• Training records: enrollments, syllabi and lesson progress, sign-offs, instructor comments, training logs, and logbook entries.
• Flight and aircraft records: reservations, schedules, dispatch and check-in/check-out records, Hobbs and tach times, routes, aircraft tracks from ADS-B and FlightAware data, maintenance and inspection records, and squawks.
• Photos and signatures: checkout photos or selfies (where a School requires them), aircraft photos, and electronic signatures on training records, onboarding documents, and policies.
• Billing records: invoices, balances, packages, memberships, payment history, and limited payment details from Stripe (card brand, last four digits, expiration date, and Stripe identifiers).
• Employment-related records: instructor pay rates, timecards, clock-in and clock-out times, and payroll reports.
• Communications: team chat messages, reservation comments, emails and texts sent through the Services, and, if a School connects Gmail or Outlook, the email threads it chooses to sync with its customer records.
• Customer relationship (CRM) records: prospective students’ and customers’ names, contact details, notes, and imported contacts.
• AI inputs and outputs: prompts, voice recordings submitted for transcription, and content Arlo and other AI features generate from School Data.
• Reports and exports a School creates, such as TSA compliance packages and training or flight reports.

7. How We Use School Data

We use School Data only to provide, secure, support, and maintain the Services for the School, to follow the School’s instructions (including through its settings and the integrations it turns on), to prevent fraud and abuse, and to comply with law. We may also create de-identified, aggregated data that doesn’t identify any School or individual, to operate and improve the Services. We do not sell School Data, use it for advertising, or use it to train third-party AI models.

8. School Responsibilities

Each School is responsible for having a lawful basis to collect School Data, giving any required notices and getting any required consents (including parent or guardian consent for minors), limiting access to sensitive documents within its organization, and responding to requests from its students and staff. If you are a student, instructor, or staff member, the School’s privacy policy and practices apply to your information.

Part C: Sharing, Security, and Your Choices

9. Who We Share Information With

9.1 Service providers (subprocessors). We use the following providers to run the Services. They include:

These providers may use personal information only to provide their services to us, and for security and legal compliance as their terms allow. We use OpenAI’s business API, under terms that do not allow OpenAI to use the data we send to train its models. OpenAI may keep that data for a limited time to monitor for abuse. We will update this list before a new provider begins processing School Data.

9.2 Integrations you or your School choose. If you or your School connect a third-party service, we send it, or receive from it, the information needed for that connection. That service’s own terms and privacy policy apply. These services include Google (sign-in, Google Calendar, and Gmail), Microsoft (Outlook), Intuit (QuickBooks), FlightSense, and anyone the School gives API or AI-agent (MCP) access to its workspace.

9.3 Your School. Information in a School workspace is available to that School’s authorized users, as the School configures it.

9.4 Legal and safety reasons. We may disclose information if we believe in good faith that it is needed to comply with law, a subpoena, or a court order; to protect the rights, property, or safety of Sky Schedule, our users, or others; to detect or prevent fraud or security problems; or to enforce our agreements. Where the law allows, we will notify the affected School before disclosing School Data.

9.5 Business transfers. If Sky Schedule is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

9.6 With consent. We may share information for other purposes with your consent or at your direction.

10. Security

We use administrative, technical, and physical safeguards designed to protect personal information. These include encryption in transit (HTTPS), encryption at rest by our hosting providers, role-based access controls within each School’s workspace, measures designed to keep each School’s data separate from other Schools’, and activity logging. No system is completely secure, and we cannot guarantee that information will never be accessed, disclosed, altered, or lost. If we confirm a security incident affecting School Data, we will notify the affected School without undue delay and give it the information it reasonably needs to meet its own obligations. Please protect your password and tell us right away at ryan@skyschedule.info if you suspect unauthorized access.

11. Retention

We keep personal information for as long as needed for the purposes in this Policy. That includes as long as your account or your School’s subscription is active, plus as long as needed for billing, tax, legal, security, and dispute purposes. School Data is kept as long as the School keeps it in the Services. When a School’s subscription ends, the School has 30 days to export its data. We then delete or de-identify School Data within 90 days, except where the law requires us to keep it or as needed for billing, tax, fraud-prevention, or dispute records. Backups are overwritten in the ordinary course. Agreement acceptance records are kept for as long as the agreement may be enforced.

12. Where Information Is Stored

Sky Schedule is based in the United States. Our database and file storage are hosted in the United States. If you use the Services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

13. Children and Minors

13.1 Minors 13 to 17. Student pilots can be under 18. Minors may use the Services only if a School enrolls them, and the School is responsible for getting consent from a parent or legal guardian. A payment method saved for a minor must belong to a parent, guardian, or other adult payer. Parents and guardians who want to review, correct, or delete a minor’s information should contact the School. We will help the School respond.

13.2 Children under 13. The Services are not directed to children under 13, and no one under 13 may have a login. Sky Schedule does not knowingly collect personal information directly from children under 13. If a School records limited information about a child under 13 (for example, the name of a participant in a discovery flight booked by an adult), the School is responsible for getting verifiable consent from the child’s parent or guardian. If we learn that we collected personal information directly from a child under 13 without that consent, we will delete it. Contact ryan@skyschedule.info if you believe this has happened.

14. Your Choices and Rights

14.1 Your account. You can review and update much of your profile in the Services. You can turn off non-essential notifications in your settings, unsubscribe from marketing emails using the link in the email, and stop texts by replying STOP.

14.2 School Data. For information in a School workspace, send your request to the School. If you contact us, we will forward your request to the School or tell you to contact the School directly.

14.3 State privacy rights. Depending on where you live, you may have the right to:

• know what personal information we have about you and get a copy;
• correct inaccurate information;
• delete your information;
• opt out of the sale of personal information, sharing for targeted advertising, or certain profiling (we don’t do these); and
• not be discriminated against for using these rights.

To make a request about information in Part A, email ryan@skyschedule.info with the subject line “Privacy Request.” We will verify your identity by confirming information we already have, such as your account email. You may use an authorized agent, who must show proof of your written permission. We may also ask you to confirm your identity with us directly. If we deny your request, you can appeal by replying with “Appeal” in the subject line. We will respond to appeals within the time the law requires. If you are not satisfied, you may contact your state attorney general.

14.4 California residents. In the last 12 months, we collected the categories of personal information described in Sections 2 and 6: identifiers, customer records, commercial information, internet and network activity, approximate geolocation, audio and visual information, professional or employment-related information, education (training) records, and, where a School chooses to collect it, sensitive personal information such as government ID and passport information. We use sensitive personal information only to provide the Services and as permitted by law, not to infer characteristics about anyone. We collected it from the sources and for the purposes described in this Policy, and disclosed it to the categories of recipients in Section 9 for business purposes. We do not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. Under California’s “Shine the Light” law, you may ask whether we disclosed personal information to third parties for their direct marketing. We do not.

15. Changes to This Policy

We may update this Policy. We will post the new version with a new version number and “Last updated” date. If a change is material, we will notify you by email or in the Services at least 30 days before it takes effect, unless a shorter period is required by law or the change is needed for security.

16. Contact Us

Baumann Systems, LLC d/b/a Sky Schedule Attn: Privacy 1000 Wyman Drive, Waterford, MI 48328 Email: ryan@skyschedule.info